Although the main module allows to view unpublished paragraphs in frontend if setting `show_unpublished` is `true` for priviledged users, the submodule paragraphs_type_permissions has the hook_access that forbids access to all unpublished paragraphs without checking any conditions.

I suggest to add the checks for 'view unpublished paragraphs' permission in paragraphs_type_permissions_paragraph_access too.

The patch is attached.

Comments

a.dmitriiev created an issue. See original summary.

a.dmitriiev’s picture

berdir’s picture

Status: Active » Needs work

This might have existed from before we had the logic in paragraphs itself? Does anything break if you just remove it? If yes, what if you return neutral() in that case instead of forbidden?

a.dmitriiev’s picture

Removing that part allows non-priviledged users to see unpublished paragraphs. Trying with neutral() now. Will write back soon with the results.

a.dmitriiev’s picture

AccessResult::neutral() did the trick. New patch is attached.

a.dmitriiev’s picture

Status: Needs work » Needs review
berdir’s picture

Status: Needs review » Needs work
Issue tags: +Needs tests

Ok, that makes sense. It doesn't forbid nor explicitly allow access, letting others make that decision then.

I suppose one question is how it overlaps. E.g., if you have view unpublished but not view type X, should you then be able to see an unpublished paragraph of type X or only when you have both permissions?

tests are really important for access related things, so lets make whatever we decide explicit with test coverage.

\Drupal\paragraphs_type_permissions\Tests\ParagraphsTypePermissionsTest has some existing unpublished tests, making sure that users can't access them anymore. Lets extend that with a use that does have the unpublished permission.

a.dmitriiev’s picture

Ok, thanks for reviewing this issue Berdir. I will check couple of more test cases and try to update \Drupal\paragraphs_type_permissions\Tests\ParagraphsTypePermissionsTest with more examples.

a.dmitriiev’s picture

I did some research and found that with patch from #5 it is possible to view unpublished paragraphs without permission to view paragraphs of certain type. I think this is wrong, so I am re-writing the patch and updating the tests.

a.dmitriiev’s picture

StatusFileSize
new3.26 KB
a.dmitriiev’s picture

Status: Needs work » Needs review
mylies’s picture

same issue for me - the paragraphs displays incorrectly with inline entity form mode if it's unpublished and current user have permission to view unpublished paragraphs

and here is new patch: the difference mostly in code stylistic + few access check added + notice that it's not good idea to cache the access check results when entity is unpublished

mylies’s picture

StatusFileSize
new1.29 KB

damn, sorry - logic mismatch

Status: Needs review » Needs work

The last submitted patch, 13: paragraphs_type_permissions_view_unpublished_3095959-13.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

dhruv panchal’s picture

Team any solution we can get for this issue ?

Thanks,
Dhruv

matej.lehotsky’s picture

Updated #10 patch, where i remove statement that prevent execute permission checks on "view" operation

matej.lehotsky’s picture

llevante’s picture

cgmonroe’s picture

In case someone else needs this.

Here is a patch that combines the mutually exclusive patches from this issue (#18) and #3056358: Add option to set permission to view/edit/create/delete any paragraph type when using paragraphs type permissions (merge req).

This patch will display unpublished when using paragraphs_type_permissions AND add the CRUD permissions for 'any paragraph'.

The view any paragraph for anonymous avoids the common mistake of creating a paragraph and not granting view permission.